Behavioral task
behavioral1
Sample
Mail PassView 1.42/mailpv.chm
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Mail PassView 1.42/mailpv.chm
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
Mail PassView 1.42/mailpv.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
Mail PassView 1.42/mailpv.exe
Resource
win10v2004-20231222-en
General
-
Target
4080501ff68affc83aeb55211c533bf7
-
Size
51KB
-
MD5
4080501ff68affc83aeb55211c533bf7
-
SHA1
7ce0e0e4fee116966875750e10b6b5564c7a68e2
-
SHA256
41bc3d81d17fd6016519e128cf66e916fec4698a46ba0165a5e902dd3e0a1e39
-
SHA512
0dbbcba1144c6f7593037ec9a4dc40cc686e01aa72f424cbbec763ebce6f83491b9d679ec6c3cc3b18aa7fd582063b10e751e3b4b9d52441d9d0bd9300e6e16f
-
SSDEEP
1536:uIAi+Cpbv3T93x2inw93xyND+6OCl4dU+gHLLHwaP70:PcCpSinw9hO+vCe6LHwaPY
Malware Config
Signatures
-
Nirsoft 1 IoCs
resource yara_rule static1/unpack002/out.upx Nirsoft -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
resource yara_rule static1/unpack002/out.upx MailPassView -
resource yara_rule static1/unpack001/Mail PassView 1.42/mailpv.exe upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Mail PassView 1.42/mailpv.exe unpack002/out.upx
Files
-
4080501ff68affc83aeb55211c533bf7.zip
-
Mail PassView 1.42/mailpv.chm.chm
-
Mail PassView 1.42/mailpv.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 64KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 57KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Mail PassView 1.42/mailpv_lng.ini
-
Mail PassView 1.42/readme.txt